elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.05k stars 4.89k forks source link

x-pack/filebeat/input/httpjson: add ability to remove request trace logs #40003

Closed efd6 closed 3 days ago

efd6 commented 4 days ago

Proposed commit message

This is a replay of #39969, but for the HTTPJSON input.

The previous configuration system did not allow users to remove trace logs from agents after they are no longer needed. This is potential security risk as it leaves potentially sensitive information on the file system beyond its required lifetime. The mechanism for communicating to the input whether to write logs is not currently powerful enough to indicate that existing logs should be removed without deleting logs from other instances. So add an enabled configuration option to allow the target name to be sent independently of whether the files should be written or removed.

The new option is optional, defaulting to the previous behaviour so that it can be opted into via progressive repair in the client integrations.

Checklist

Disruptive User Impact

Author's Checklist

How to test this PR locally

Related issues

-

Use cases

Screenshots

Logs

elasticmachine commented 4 days ago

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)